Privacy notice
Your practice. Your information.
A plain-language description of the current RepForge build—not a claim of legal compliance or a promise that third-party services keep no data.
What RepForge stores
Account details (name, email where provided, hashed password for password accounts), workspace membership, sales profiles and custom scenarios. Simulations include transcripts, AI evaluations, coaching, retries, progress and timestamps. Optional report ratings, pseudonymous usage events, public-sharing preferences, requested-email receipts and uploaded-file metadata/extracted facts are stored separately. Guest practice is also stored in the database—not only in your browser. Uploaded originals use private encrypted storage when enabled.
Your microphone and AI voice
Browser speech normally sends RepForge recognised text; the browser may send microphone audio to its own speech provider. When the optional fallback transcription connector is enabled and browser speech is unavailable or fails, short recordings pass through RepForge to the transcription provider and are discarded by RepForge, not saved to the database. Provider retention terms still apply. ElevenLabs receives AI prospect text for speech output, which can repeat information you shared. RepForge temporarily caches generated prospect audio for up to one day; this is not a recording of you. Typed practice avoids microphone use, but its text still goes to the AI provider.
Where your information goes
Transcript text, scenario and product context, relevant earlier-call memory, and coaching prompts are sent to the configured AI service: OpenAI, or Anthropic through Emergent’s integration. ElevenLabs supplies generated speech. Emergent hosts the app and manages optional Google sign-in, fallback transcription and file storage. Google/Emergent supply identity details to connect your account. Resend receives your account email and the report or team summary only when you request email and sending is enabled. We do not request access to your Gmail, Drive or Calendar. Provider processing can take place outside your country.
Provider retention is separate
RepForge has not verified zero-retention or provider training opt-outs for these service accounts. Provider retention, safety logging and data-use terms apply independently. Deleting data here does not erase copies already processed by providers, infrastructure logs or private operator backups. We cannot promise a fixed backup purge date or independently verify provider deletion.
Who can see your practice
Your history and export require your authenticated session. Verified workspace managers can view team performance and assignments; a matching organisation name does not grant access. Authorised service operators can access the database for maintenance and support. Public Results contains aggregate recorded-practice data; an individual first/latest example requires your explicit consent and includes only scores and skill names. Public scorecard links are opt-in and exclude identity, quotations, transcript and product facts. Anyone with a link can view its summary until you revoke it; cached third-party copies may remain. This is not a promise of end-to-end encryption or a security certification.
How long data stays
Training and profile records remain until you delete them; there is no automatic guest-account expiry. Closing a tab, clearing browser storage or signing out is not server deletion. Temporary Google sign-in flows expire after 10 minutes, replay-protection records after one day, recovery requests after three days and invitations after two days. MongoDB expiry is asynchronous.
Cookies and browser storage
The essential repforge_session cookie maintains sign-in (up to 14 days). A 12-hour bearer fallback is stored in tab sessionStorage for cookie-blocked previews. Browser storage also holds your cached user ID, cross-tab sign-in signal, temporary Google sign-in proof and microphone-check state. RepForge has no implemented advertising-cookie banner, paid subscription checkout or third-party marketing analytics. Server-side product usage events still exist.
Your choices and limits
Export your JSON or permanently delete your account, current guest data or individual sessions using Your data & controls. Session deletion also removes linked retries, public share links, feedback and derived memory. Account deletion removes your active-database records, including file decryption keys, not other workspace members’ records. Encrypted file copies may remain with the storage provider but their keys are erased from the active database. Keep exported files and emails private: downloaded or delivered copies remain outside RepForge after account deletion.
Practise with fictional information
Do not enter real customer secrets, sensitive personal information, payment details or health records. This is AI sales training, not medical or crisis support. The AI is instructed to pause roleplay for distress and encourage human help where needed, but detection is not guaranteed and nobody monitors practice for emergencies.
Provider notices
A verified contact address has not been configured yet.
Do not email passwords, reset links, or confidential customer information.